flyio-security-basics

# Fly.io Security Basics ## Overview Fly.io deploys applications to edge locations worldwide using Firecracker microVMs. Security concerns center on deploy token scoping (org-wide vs per-app), secrets management (encrypted at rest, injected as env vars), private networking via WireGuard mesh (6PN), and TLS certificate management. A leaked deploy token can push arbitrary code to production machines across all regions. ## API Key Management ```typescript function validateFlyToken(): void { const token = process.env.FLY_API_TOKEN; if (!token) { throw new Error("Missing FLY_API_TOKEN — use `fly tokens create deploy -a <app>`"); } // Never log tokens; log only token type for debugging const isDeployToken = token.startsWith("FlyV1"); console.log("Fly.io token loaded, type:", isDeployToken ? "deploy" : "personal"); } ``` ## Webhook Signature Verification ```typescript import crypto from "crypto"; import { Request, Response, NextFunction } from "express"; function verifyFlyWebhook(req: Request, res: Response, next: NextFunction): void { const signature = req.headers["x-fly-signature"] as string; const secret = process.env.FLY_WEBHOOK_SECRET!; const expected = crypto.createHmac("sha256", secret).update(req.body).digest("hex"); if (!signature || !crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected))) { res.status(401).send("Invalid signature"); return; } next(); } ``` ## Input Validation ```typescript import { z } from "zod"; co...